CVE-2022-28368

Remote code injection in dompdf/dompdf

9.8 CriticalPublic exploitFix available

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

83.9%Up 79.5 points since Apr 3, 2022

What each source reports

NVD Score used 9.8

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

Record: CVE-2022-28368
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

Record: CVE-2022-28368
Updated: 2026-11-02

EUVDEUVD-2022-1865 No score

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

Record: EUVD-2022-1865
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x752-qjv4-c4hc 9.8

Remote code injection in dompdf/dompdf

Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

Record: GHSA-x752-qjv4-c4hc
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-x752-qjv4-c4hc 9.8

Remote code injection in dompdf/dompdf

Record: GHSA-x752-qjv4-c4hc
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-79
Updated: 2026-11-02

OSVCLSA-2025-1766364765 No score

TuxCare security update for dompdf/dompdf (8 CVEs)

TuxCare rebuilt dompdf/dompdf to address 8 CVEs. Fixed in 0.8.6-p1+tuxcare.

Record: CLSA-2025-1766364765
Updated: 2026-11-02

OSV No score

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

Record: CVE-2022-28368
Updated: 2026-11-02

Affected products

dompdf project dompdf

Affected packages

Affected packages
Package	Affected	Fixed
`dompdf/dompdf` Packagist	before 1.2.1	1.2.1
`dompdf/dompdf` TuxCare:Packagist From an advisory covering 8 CVEs	0.8.6 up to 0.8.6-p1+tuxcare	0.8.6-p1+tuxcare
`dompdf/dompdf` Packagist	before 1.2.1, plus listed versions v0.6.0v0.6.1v0.6.2v0.7.0v0.7.0-beta Show 15 moreShow less v0.7.0-beta2v0.7.0-beta3v0.8.0v0.8.1v0.8.2v0.8.3v0.8.4v0.8.5v0.8.6v1.0.0v1.0.1v1.0.2v1.1.0v1.1.1v1.2.0	1.2.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Dompdf RCE via Malicious Font Caching (CVE-2022-28368)	2022-04-05
PoC in GitHub	rvzsec/CVE-2022-28368	2023-02-13
Exploit-DB	Dompdf 1.2.1 - Remote Code Execution (RCE)	2023-04-06
PoC in GitHub	That-Guy-Steve/CVE-2022-28368-handler	2023-04-28
PoC in GitHub	Henryisnotavailable/Dompdf-Exploit-RCE	2023-05-07

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, exploits, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-28368 is a critical vulnerability (CVSS 9.8) in Dompdf Project Dompdf, published April 3, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 83.9%, the 99th percentile. Fixed in dompdf/dompdf 1.2.1.

References

Show 6 moreShow less